🔢 mathematics

Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fiber Bundle of Module-Lattice Keys

This paper introduces Z-Sigil, a public-key cryptosystem that chains Module-Lattice keys via a fiber bundle structure and a hash-based state update mechanism to achieve IND-CPA security under decisional Module-LWE assumptions, while providing a formal correctness proof and noise analysis without establishing authentication, chosen-ciphertext security, or concrete security levels.

Original authors: Andrea Rondelli

Published 2026-10-01✓ Author reviewed ⓘ

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Andrea Rondelli

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, keeping secrets safe relies on a delicate balance between complexity and predictability. Modern encryption often uses mathematical structures called lattices, which are like vast, multi-dimensional grids of points. To hide a message, a sender scrambles it using a secret key, adding a tiny amount of random noise to the result. This noise makes the scrambled message look like random static to anyone without the key, but a person with the correct key can subtract the noise and read the original text. The security of these systems depends on the fact that finding the secret key from the noisy public information is incredibly difficult, even for powerful computers. As quantum computers threaten to break many of today's codes, researchers are constantly looking for new ways to arrange these mathematical grids to stay one step ahead.

A researcher has proposed a new way to organize these keys, moving away from the standard practice of using a single secret for an entire message. Instead of relying on one static key, their system, called Z-Sigil, uses a large family of different keys, all generated in advance. The unique feature of this design is that the message itself decides which key to use for each piece of the data. As the message is broken down into small blocks, the content of each block determines the path taken through the family of keys. This creates a dynamic journey where the order of keys is not fixed by the sender or the receiver, but is instead dictated by the data being sent. The researcher built this system on a geometric framework they describe as a bundle of keys over a flat torus, a shape that can be thought of as a doughnut surface where opposite edges connect, though in their work, this is a discrete, finite version used for calculation.

The core of the proposal is a method where the plaintext, or the readable message, acts as a guide. Before any message is sent, the system generates a fixed set of secret keys and their corresponding public versions. When a message is prepared, it is divided into 32-byte chunks. For the first chunk, the system uses a public starting point to select a key. Once that chunk is encrypted, the system uses the recovered content of that chunk to update its internal state, which then selects the key for the next chunk. This process repeats for the entire message. Because the selection of the next key depends on the content of the previous one, the path through the family of keys is unique to that specific message. If an attacker tries to guess the path without knowing the message, they face a moving target where the rules change with every step.

The researcher proved that this method works correctly under specific conditions. They showed that if the noise added during encryption stays within a certain limit, the receiver can successfully recover the message by following the same path. They calculated that for a typical message size of 64 blocks, the chance of the system failing to decode the message is vanishingly small, far less than one in a trillion trillion. Under stated decisional Module-LWE assumptions, they proved confidentiality against chosen-plaintext attacks (IND-CPA) for the complete chain, allowing messages chosen after the public key. However, they were careful to distinguish between reliability and security. While the system is highly reliable and offers IND-CPA security, they explicitly noted that the scheme provides no authentication or chosen-ciphertext security. Furthermore, they demonstrated that if an attacker manages to learn a subset of the secret keys, their ability to decrypt is strictly limited to a specific "direct-prefix" model where they can only recover the initial blocks of a message if the path happens to land on those known keys; this does not bound the capabilities of an unrestricted adversary.

The paper also addresses why this new approach was necessary by looking at a previous attempt by the same researcher. An earlier version of the idea tried to use a more complex geometric shape, but it failed because it accidentally revealed a part of the secret message in plain sight. The new design fixes this by ensuring the message never multiplies a public object, which was the cause of the leak in the old version. Instead, the message simply selects between two options, keeping the relationship between the secret and the public data noisy and hidden. The researcher also explored what would happen if the system tried to move the keys around in a more complex way, like twisting the path as it goes. They found that doing so without breaking the mathematical rules of the system is extremely difficult, as it would require the keys to change in ways that are almost impossible to achieve with whole numbers.

Ultimately, this work presents a new architecture for encryption rather than a finished product ready for immediate use. It offers a fresh perspective on how to link keys together, using the message itself to drive the process. The researcher provides detailed blueprints for how to build the system, including specific numbers for the size of the keys and the amount of noise required. They also provide a way for others to test the system and verify the results. While the system does not yet have a proven security level against all possible attacks, and it lacks features like message authentication or chosen-ciphertext security, it stands as a rigorous mathematical exploration of a new way to hide data. It shows that by letting the message choose its own path through a forest of keys, one can create a system that is both highly reliable and structurally distinct from the static methods used today.

Technical Summary of "Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fibre Bundle of Module-Lattice Keys"

Problem Statement
Standard public-key cryptosystems typically fix a single secret key to encrypt all blocks of a message. Z-Sigil addresses the architectural question of whether a plaintext can determine the order in which a pre-generated family of secret keys is accessed, creating a "walk" through a key space rather than a static application of a single key. The paper investigates this architecture to determine if such a coupling of a plaintext-fed state with a lattice-key family can be constructed securely and correctly, while avoiding the pitfalls of previous geometric proposals that inadvertently exposed plaintext scalars.

Methodology and Construction
The construction is built upon three distinct components:

Module-LWE Foundation: The core arithmetic relies on the Module-Learning With Errors (Module-LWE) assumption. A shared public matrix $A$ and a family of public vectors $b_t = A s_t + e_t$ are generated, where $s_t$ are small secret vectors and $e_t$ are small error vectors.
Geometric Abstraction (Fibre Bundle): The key family is modeled as a section $\sigma$ of a discrete fibre bundle over a finite base $P$ (a set of torsion points on a flat Kähler torus). The public key is a noisy image of this section. The message does not create new keys; rather, it traces a "walk" $\gamma$ on the base $P$ , selecting which fibre (and thus which secret key $s_t$ ) is used for each block.
Chained Selection Mechanism:
- State Initialization: A public nonce initializes a hash state $x_{-1}$ .
- Block Processing: For each block $i$ , the current state $x_{i-1}$ is hashed to select a key index $t_i$ and derive a bit-mask $\kappa_i$ .
- Encryption: The plaintext block $m_i$ is masked ( $\mu_i = m_i \oplus \kappa_i$ ) and encrypted using the selected key $s_{t_i}$ via a standard Lindner–Peikert/Kyber-style block map, producing ciphertext $(u_i, v_i)$ .
- State Update: The recovered plaintext $m_i$ (known to the sender, recovered by the receiver) is fed back into the hash function to update the state $x_i$ , determining the key for the next block.

This creates a dependency where the trajectory of key selection depends on the message content, but the keys themselves are generated independently of the message prior to encryption.

Key Contributions
The paper makes the following specific technical contributions:

Geometric Framework: It defines a discrete fibre bundle of module-lattice keys over a flat Kähler torus, where the private key is a section and the public key is a noisy image under a fibrewise endomorphism.
Explicit Specifications: It provides complete, separate specifications for key generation, encryption, and decryption, including a specific block map and a chained-inversion proposition.
Correctness Proof: It proves that decryption succeeds if the accumulated noise (from key generation errors and fresh encryption errors) remains within a specific bound. A decoding-failure upper bound is derived, conditioned on the specific key family realization (e.g., $< 2^{-192}$ for 16 keys and 64 blocks).
Security Reduction: It establishes a conditional IND-CPA (Indistinguishability under Chosen-Plaintext Attack) reduction for the complete chain. This reduction allows messages to be chosen after the public key is known, without modeling the hash function as a random oracle. The proof utilizes two routes: guessing the fibre (costing a factor of $T$ ) or embedding challenges in all fibres simultaneously.
Analysis of Partial Exposure: It provides exact probabilistic laws for a "direct-prefix" recovery model where an adversary possesses a subset of keys. It demonstrates that while an exposed key allows recovery of a prefix of the message, the chained structure prevents immediate recovery of subsequent blocks unless the walk remains over the exposed keys.
Correction of Previous Work: It explicitly identifies and fixes the failure of an earlier geometric proposal (which exposed a plaintext scalar along a public direction) by ensuring plaintexts enter additively and are masked, preventing scalar exposure.

Results and Bounds

Reliability: For a configuration with $T=16$ keys and $L=64$ blocks, the decoding failure probability is bounded below $2^{-192}$ . This is a reliability bound, not a security level estimate.
Security: The confidentiality of the scheme is conditional on the hardness of the Decisional Module-LWE problem. The reduction incurs multiplicative losses (e.g., factors of $T$ or $L$ ) depending on the reduction path chosen, meaning the scheme does not claim a specific concrete security level (e.g., 128-bit) without further assumptions on the underlying lattice problem.
Exposure Limits: In a restricted model where an adversary holds a fraction $p$ of the keys, the expected number of directly recoverable blocks follows a capped geometric distribution. However, the paper notes this does not bound unrestricted adversaries who might use candidate-message attacks or known-plaintext to infer future states.

Significance and Claims
The paper modestly frames Z-Sigil as a study of a specific composition architecture rather than a new cryptographic primitive or a standard-compliant implementation (it is not an ML-KEM).

No Authentication: The scheme provides no authentication or chosen-ciphertext (IND-CCA) security.
No Quantum Speedup Claim: The geometric motivation references quantum superposition concepts (citing Manin) but explicitly states this is a motivation for studying the architecture, not an argument that the scheme prevents quantum attacks.
Research Direction: The work serves as a "testbed" for exploring path-dependent geometry in cryptography. It distinguishes between the current flat geometry (which serves as a representation) and future research into curved, non-trivial bundles with transport and holonomy, noting that current integral-transport constraints are severe (limited to signed permutations to preserve noise budgets).
Verification: The paper emphasizes reproducibility, providing byte profiles, pseudocode, and known-answer vectors, while keeping implementation records separate from the mathematical proofs.

In summary, Z-Sigil demonstrates that a plaintext-dependent walk over a pre-generated family of lattice keys can be constructed with provable correctness and conditional confidentiality, provided the noise budget is managed and the geometric structure does not inadvertently expose plaintext scalars. It serves as a rigorous proposal for a specific class of stateful, key-family-based encryption, distinct from standard KEMs, with explicit boundaries on its security guarantees.

Technical Summary of "Z-Sigil: A Public-Key Cryptosystem with Chained Selection over a Fibre Bundle of Module-Lattice Keys"

More like this